2

I already update using yum update openssl but still my server is vulnerable. Tried grep 'libssl.*(deleted)' /proc/*/maps and no result as I already restarted the server. Yet, it is still vulnerable.

$ rpm -qa | grep openssl
openssl-devel-1.0.1e-30.el6_6.4.x86_64
openssl-1.0.1e-30.el6_6.4.x86_64

Did I miss something to execute?

I scanned my site with the acunetix scanner, and the one from redhat website. all says it is vulnerable.

Here are some additional details:

grep libssl.so.1.0.1e /proc/*/maps | cut -d/ -f3 | sort -u | xargs -r -- ps uf
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     30932  0.0  0.3  77076  7612 ?        Ss   18:50   0:00 squid -f /etc/squid/squid.conf
squid    30935  0.0  1.3 119244 26256 ?        S    18:50   0:00  \_ (squid-1) -f /etc/squid/squid.conf
root     30907  0.0  0.2  81328  3852 ?        Ss   18:50   0:00 /usr/libexec/postfix/master
postfix  30911  0.0  0.2  81592  3872 ?        S    18:50   0:00  \_ qmgr -l -t fifo -u
postfix  31221  0.0  0.1  81408  3840 ?        S    20:30   0:00  \_ pickup -l -t fifo -u
root     30775  0.0  1.0 290340 20900 ?        Ss   18:50   0:00 /usr/sbin/httpd
apache   31041  0.0  1.6 520736 31100 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31042  0.0  1.1 316740 22496 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31043  0.0  0.9 313992 18868 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31044  0.0  1.4 520416 28544 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31047  0.0  1.0 314700 21104 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31048  0.0  1.4 448284 27656 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31051  0.0  1.2 317584 23292 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31052  0.0  1.1 317472 22872 ?        Sl   19:08   0:00  \_ /usr/sbin/httpd
apache   31065  0.0  1.1 316592 21676 ?        Sl   19:09   0:00  \_ /usr/sbin/httpd
apache   31082  0.0  1.4 445272 28168 ?        Sl   19:30   0:00  \_ /usr/sbin/httpd
apache   31085  0.0  0.8 313452 17208 ?        Sl   19:30   0:00  \_ /usr/sbin/httpd
apache   31086  0.0  1.0 315984 20944 ?        Sl   19:30   0:00  \_ /usr/sbin/httpd
apache   31091  0.0  1.4 447032 27504 ?        Sl   19:31   0:00  \_ /usr/sbin/httpd
apache   31094  0.0  0.8 311240 16208 ?        Sl   19:31   0:00  \_ /usr/sbin/httpd
apache   31095  0.0  1.1 316264 21408 ?        Sl   19:31   0:00  \_ /usr/sbin/httpd
apache   31210  0.0  0.8 311228 16100 ?        Sl   20:23   0:00  \_ /usr/sbin/httpd


 ldd sbin/httpd
        linux-vdso.so.1 =>  (0x00007fff50dff000)
        libm.so.6 => /lib64/libm.so.6 (0x00007fd9501e5000)
        libpcre.so.0 => /lib64/libpcre.so.0 (0x00007fd94ffb9000)
        libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fd94fd99000)
        libaprutil-1.so.0 => /usr/lib64/libaprutil-1.so.0 (0x00007fd94fb75000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fd94f93e000)
        libexpat.so.1 => /lib64/libexpat.so.1 (0x00007fd94f715000)
        libdb-4.7.so => /lib64/libdb-4.7.so (0x00007fd94f3a1000)
        libapr-1.so.0 => /usr/lib64/libapr-1.so.0 (0x00007fd94f175000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fd94ef57000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fd94ebc3000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fd94e9bf000)
        /lib64/ld-linux-x86-64.so.2 (0x0000003747a00000)
        libuuid.so.1 => /lib64/libuuid.so.1 (0x00007fd94e7ba000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007fd94e541000)

openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Thu Oct 16 11:05:49 EDT 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic
  • What tool are you using to check the server is vulnerable? – richardb Dec 10 '14 at 10:09
  • What gets targeted by the scanner? Is it possible you scan something which brings it's own SSL library instead of using the one provided by the OS? – Sven Dec 10 '14 at 12:37
  • Thank you for editing. above are my details. i haven't re-compile my openssl and delete the old library ( this is what i saw in other forums ) – iceiceice Dec 10 '14 at 12:47
5

OpenSSL on RHEL6 is affected only in versions openssl-1.0.1e-15 through openssl-1.0.1e-16.el6_5.4. openssl-1.0.1e-16.el6_5.7 and later contain a fix backported from OpenSSL 1.0.1g and don't bump the letter part of the serial number up. Thus, it's likely you are confused by the e and your system is in fact patched.

Source: https://access.redhat.com/solutions/781793

BTW: You are very late for that particular party.

  • Hi Sven, thank you for your reply ,yes i patched it with current openssl update , but scanning tools says it is still vulnerable to heartbleed. This is only the only server i have which is still vulnerable, all the rest are patched via "yum update openssl " and was no longer affected after scan. i dont know what else to do, i did a restart and perform grep 'libssl.*(deleted)' /proc/*/maps and no package is using the old ones anymore. yet still vulnerable. – iceiceice Dec 10 '14 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.